feature/Hook-bundle-provenance-check · L-260912-f6d1d9 — release refuses a stale hook bundle

[lchoquel]

A vendored hook bundle that is behind its sources shipped green once already, because nothing compared it with what `pipelex-sdk-js` would build. `make check` now refuses, offline and in CI, a bundle whose provenance names an unreleased engine or no SDK commit, and the new `make check-hook-fresh`, which the release skill runs first, fails when the vendored engine is not npm's latest or when a rebuild in the sibling checkout would change the bundle below its banner. Measured: it passes on the current bundle, fails on both questions against the pre-0.8.0 bundle, and two builds of one SDK commit were byte-identical.

Closes L-260912-f6d1d9

🤖 Generated with Claude Code

https://claude.ai/code/session_01BvNKvZPgARPAQwuyafhQ2W

---

Summary by cubic

Stops a release from shipping a vendored hook bundle that is behind its sources, which already happened once when nothing compared the bundle with what pipelex-sdk-js would build.

• make check now refuses, offline and in CI, a bundle whose provenance names an unreleased tools-wasm engine or no SDK commit. The guard accepts abbreviated hashes, from git's four-character minimum up to a full SHA-256 name.
• New make check-hook-fresh release gate, run first by the release skill, fails when the vendored engine is not npm's latest or when a rebuild in the sibling checkout changes the bundle below its banner; it refuses to answer unless that checkout is on dev, clean, and level with origin/dev. A git that is missing or times out now refuses with exit 2 instead of ending in a traceback.
• When stale, the gate names the cure: re-vendor with make vendor-hook, and bump the engine pin in pipelex-sdk-js first if that repo still pins an older version. The rebuild strips any local PIPELEX_TOOLS_WASM_PATH override so it always bundles the npm engine npm ci installed.

^{Written for commit 4697f3e. Summary will update on new commits.}

[lchoquel]

/rev round 1, profile 3 (derived), bar open. Reviewers: cubic, Codex (codex:review), and code-review at level low. Every finding was checked by a separate verifier before any fix.

Fixed in 4697f3e:

• If git times out or is missing, the gate now refuses with exit 2, the "could not answer" code. Before, it ended in a traceback with exit 1, which reads as "stale". Raised by code-review, cubic and Codex.
• npm run build:hook now runs without PIPELEX_TOOLS_WASM_PATH, so the rebuild always bundles the engine that npm ci installed from npm. Raised by cubic and Codex.
• The provenance guard now accepts an SDK commit from 4 to 64 characters long. core.abbrev can make git print a hash as short as 4 characters, and a SHA-256 hash is 64. Raised by Codex.

Deferred, unverified: when an engine is newer than npm's latest, the gate prints the wrong fix, one that would downgrade it. The gate still fails in that case; only the advice it prints is wrong. Raised by cubic, and the trace is in wip/hook-schema-revendor/plan.md under "Deferred from the reviews" for Phase 3.

Verdict for the next round: round 2, bar defects, profile 3.